Phishing Remains the Initial Infection Vector in 78% of Attacks Against OT-Heavy Industries

Phishing Remains Initial Infection VectorCompanies heavily reliant on operational technology (OT) to function are just as much a target as businesses relying in traditional IT and are facing some of the same challenges to stop attacks.

Analysts at IBM Security X-Force have released some insightful data that should be a warning to OT-heavy industries – from how much a target they really are, to where their weak spots are.

According to the data, the Manufacturing industry, not only represents nearly two-thirds (65%) of all cybersecurity incidents across OT-reliant industries, but it also tops the list of all industries, being a target in 23% of all incidents.

In these OT industries, IBM found that 78% of all incidents began with a phishing attack, with vulnerabilities and removable media each only represented in 11% of attacks. Phishing topping the list is consistent with 2021 findings as well. Malspam, specifically, was seen in 44% of incident response engagements, with the majority of malspam incidents involving the delivery of Emotet.

IBM provides several recommendations to support a layered phishing defense, but they start with one that is critical to OT environments, where users are less savvy and are focused on operational processes – Security Awareness Training. Even IBM realizes the value of employing users to act as part of your defense when solutions focused on filtering, sandboxing, analyzing, detecting, and mitigating fail to stop a phishing email from reaching the Inbox.

OT-heavy industries need to take note of IBM’s findings and strengthen their defenses against phishing, starting with Security Awareness Training.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe To Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews